CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3012 from Security-Onion-Solutions/issue/2989

Browse Source 
Issue/2989
This commit is contained in:
Josh Patterson
2021-02-18 10:52:23 -05:00
committed by GitHub
parent 3f7cdb933f 95df18c545
commit a9da761fab
2 changed files with 5 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
salt/suricata/cron/so-suricata-eve-clean
View File

@@ -24,15 +24,9 @@ read lastPID < $lf
[ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit [ ! -z "$lastPID" -a -d /proc/$lastPID ] && exit
echo $$ > $lf echo $$ > $lf
MAXEVES={{ salt['pillar.get']('suricata:cleanup:eve_json', 20) }} MAXDAYS={{ salt['pillar.get']('suricata:cleanup:eve_json', 7) }}
if [ "$MAXEVES" -lt 2 ]; then if [ "$MAXDAYS" -lt 1 ]; then
MAXEVES=2 MAXDAYS=1
fi fi
# Find eve files and remove them find /nsm/suricata/ -type f -mtime +$MAXDAYS -name 'eve-*.json*' -execdir rm -- '{}' \;
NUMEVES=$(find /nsm/suricata/ -type f -name "eve-*.json" | wc -l)
while [ "$NUMEVES" -gt "$MAXEVES" ]; do
OLDESTEVE=$(find /nsm/suricata/ -type f -name "eve-*.json" -type f -printf '%T+ %p\n' | sort | head -n 1 | awk -F" " '{print $2}')
rm -f $OLDESTEVE
NUMEVES=$(find /nsm/suricata/ -type f -name "eve-*.json" | wc -l)
done

2
salt/suricata/cron/surilogcompress
View File

@@ -1,6 +1,6 @@
#!/bin/bash #!/bin/bash
# Gzip the eve logs # Gzip the eve logs
find /nsm/suricata/eve*.json -type f -printf '%T@\t%p\n' | sort -t $'\t' -g | head -n -1 | cut -d $'\t' -f 2- | xargs nice gzip find /nsm/suricata/eve*.json -type f -printf '%T@\t%p\n' | sort -t $'\t' -g | head -n -1 | cut -d $'\t' -f 2 | xargs nice gzip
# TODO Add stats log # TODO Add stats log